Red Hat Enterprise Linux 7 Extended Lifecycle Support vulnerabilities
336 known vulnerabilities in Red Hat Enterprise Linux 7 Extended Lifecycle Support from Red Hat. 336 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.6 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Read
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer ov
- 8.6 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Read
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame d
- 8.6 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Read
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation w
- 8.6 High severity
Red Hat Enterprise Linux 10: Access of Resource Using Incompatible Type
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the doc
- 7.5 High severity
Red Hat Enterprise Linux 10: Numeric Truncation Error
The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer
- 7.8 High severity
Red Hat Enterprise Linux 10: Use After Free
A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that i
- 8.8 High severity
Red Hat Enterprise Linux 10: Improper Limitation of a Pathname to a Restricted Directory
A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path op
- 7.8 High severity
Red Hat Enterprise Linux 10: Incorrect Authorization
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Beca
- 8.1 High severity
Red Hat Enterprise Linux 10: Improper Neutralization of Input During Web Page Generation
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, th
- 8.5 High severity
Red Hat Enterprise Linux 10: Release of Invalid Pointer or Reference
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free
- 7.2 High severity
Red Hat Enterprise Linux 10: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges ca
- 9.8 Critical severity
Red Hat Directory Server 11.5 E4S for RHEL 8: Improper Authentication
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardl
- 7.5 High severity
Red Hat Directory Server 11.5 E4S for RHEL 8: NULL Pointer Dereference
A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKE
- 7.5 High severity
Red Hat Directory Server 11.5 E4S for RHEL 8: Integer Underflow (Wrap or Wraparound)
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-record length read from the wire is validated only against an upper bound. A small wire length (0, 1, or 2) produces an en
- 7.5 High severity
Red Hat Directory Server 11.5 E4S for RHEL 8: Incorrect Authorization
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to r
- 9.8 Critical severity
Red Hat Enterprise Linux 10: Missing Authentication for Critical Functionality
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the unde
- 7.5 High severity
Red Hat Enterprise Linux 10: Heap-based Buffer Overflow
A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent att
- 8.8 High severity
gvfs: Heap-based Buffer Overflow
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length ag
- 7.5 High severity
Red Hat Enterprise Linux 10: Incorrect Calculation of Buffer Size
A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during
- 8.8 High severity
WebKit: Use After Free
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.
- 7.5 High severity
Red Hat Enterprise Linux 10: Allocation of Resources Without Limits or Throttling
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodie
- 8.7 High severity
Red Hat Enterprise Linux 10: Use of Incorrectly-Resolved Name or Reference
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with
- 8.1 High severity
Red Hat Enterprise Linux 10: Incorrect Privilege Assignment
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by imperson
- 7.8 High severity
Red Hat Enterprise Linux 10: Integer Overflow or Wraparound
A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA
- 8.2 High severity
Red Hat Enterprise Linux 10: Incorrect Authorization
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust
- 7.8 High severity
Red Hat Enterprise Linux 10: Improper Link Resolution Before File Access
A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, t
- 7.6 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes be
- 7.5 High severity
Red Hat Enterprise Linux 10: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attac
- 7.5 High severity
Red Hat Enterprise Linux 10: Allocation of Resources Without Limits or Throttling
A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker
- 7.5 High severity
Red Hat Directory Server 11.5 E4S for RHEL 8: Stack-based Buffer Overflow
A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remot
- 7.5 High severity
Red Hat Directory Server 11.5 E4S for RHEL 8: Improper Neutralization of Special Elements used in an LDAP Query
A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication pl
- 7.6 High severity
Red Hat Enterprise Linux 10: Improper Neutralization of CRLF Sequences
A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inj
- 7.5 High severity
Red Hat Enterprise Linux 10: Stack-based Buffer Overflow
A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker
- 7.1 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values
- 8.0 High severity
Red Hat Enterprise Linux 10: Relative Path Traversal
A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache
- 8.8 High severity
Red Hat Enterprise Linux 10: Initialization of a Resource with an Insecure Default
A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRo
- 8.8 High severity
389-ds-base: Heap-based Buffer Overflow
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is cop
- 9.1 Critical severity
GLib: Integer Underflow (Wrap or Wraparound)
A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `s
- 7.5 High severity
GLib: Improper Limitation of a Pathname to a Restricted Directory
A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path t
- 8.6 High severity
GLib: Off-by-one Error
A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the